In client-server applications, the code executed by the client can be easily modified by the user. In order to protect the security of the entire system, the server needs to protect the integrity of the code on the client. To protect the integrity of the code on the client, the server needs to detect whether the code has been modified on the client, which is done through a process called code integrity verification.
In the existing code integrity verification methods, the server typically sends the address and size of the code that needs to be verified to the client; the client reads the data from the memory in accordance with the received address and size of the code, calculates a verification result in accordance with a verification algorithm, and sends the verification result to server; the server then compares the verification results calculated by the client and the server to determine whether the code has been modified.
There are issues in the existing client code integrity verification methods. For example, the hacker can copy the original code, and modify the verification address to the address of the copy, so that the calculated verification result will be the same. The hacker can also intercept the memory access function used to read data from memory, and provide fake data to the memory access function, so that the calculated verification result will be the same. The hacker can also provide the correct verification result directly to the server to circumvent the code integrity verification.